Coding agents fetch untrusted docs into a session that already holds terminal and repo write access

A poisoned README is a text file, but inside a coding agent it lands in a session that already holds a terminal and write access to the repository, because the harness handed the model those tools ^[1]. The attacker does not need the model to malfunction. According to the scworld.com explainer, the models behind coding agents primarily reward helpfulness by following instructions instead of being skeptical of dangerous actions ^[8], and an adversary can plant those instructions in documentation, code examples or issue comments the agent is likely to retrieve ^[9].

The article's own example is a routine ticket: fix an API usage bug. The agent consults a code repository, searches public documentation, inspects a GitHub issue, then updates source code, all inside one workflow ^[5]. Three of those steps are reads, one is a write ^[13]. Two of those reads, the public documentation and the issue, are the same places the article names as somewhere instructions can be embedded ^[15].

The obvious control is to feed the agent less, and the piece rules that out, since agent effectiveness depends on the context it collects. "The challenge is enabling agents to reason over information from many sources without allowing untrusted content to influence privileged actions," the article says ^[10]. That puts the control between retrieval and action, at the moment the harness decides which tool call is permitted after untrusted text is already in the window.

What has to be secured, on the article's account, is an execution environment made of models, context, tools, skills and orchestration logic ^[3]. Tool allowlists, the credentials the execution environment holds, the scope of repository write access and which skills are installed are all set outside the model ^[2]. Platform and AppSec teams hold those settings, whatever a model evaluation finds.

The article also extends the trust question to the components that shape how an agent behaves, which it frames as a new AI supply chain problem ^[12]. Coding agent harnesses are maturing for broader use, and the same execution layer is starting to power agents doing work well beyond software development ^[4].

It is an explainer, not an incident report: it describes the trust model and cites no CVE, victim or rate of exploitation ^[14]. The inventory it implies is short and available now, which agents hold repository write and which tools each harness exposes ^[2].